Updating system, electronic control unit, updating management device, and updating management method

An updating management method in an updating system mounted on a vehicle that includes a plurality of electronic control units (ECUs) including a first ECU and a second ECU and an update management device-including a central processing unit (CPU), each ECU including a processor for executing programs stored in memory, a storage device, a communication interface, wherein

• stopping, by the first ECU, a first un-updated program in response to turning-off of the vehicle,
• maintaining, by the second ECU, a control by a second un-updated program even when the vehicle is turned off,
• starting, by the first ECU, an operation with a first updated program iii response to turning-on of the vehicle,
• switching, by the second ECU, a program to be executed by the second ECU from the second un-updated program to the second updated program in response to the turning-on of the vehicle,
• determining, in response to the turning-on of the vehicle, whether at least one of the ECUs fails to update programs by confirming success or failure of updating programs of the ECUs;
• and
• sending the predetermined request, to the ECUs, to cause the ECUs, to switch the program executed by the first ECU to the program before the first update from the program after the first update and to, switch the program executed by the second ECU to the program before the second update from the program after the second update, on a condition that the CPU determines that at least one of the ECUs fails to update programs based on the determination performed in response to turning-on of the vehicle;
• switching, by the first ECU a program to be executed by the first ECU from the first updated program to the first un-updated program in response to the predetermined request from the update management device;
• and
• switching, by the second ECU, the program to be executed by the second ECU from the second updated program to the second un-updated program in response to the predetermined request from the updated management device.